Re: Messages received via OR
At 02:49 PM 11/29/2004, Rakotomandimby (R12y) Mihamina wrote: How could I diagnosys such a thing ? Use grep to look for it. First check for it in /usr/share/spamassassin. Below is the proper output for 2.64. If you get more, you may have a problem. $ grep RCVD_IN_ORBS /usr/share/spamassassin/* /usr/share/spamassassin/30_text_it.cf:lang it describe RCVD_IN_ORBS Ricevuto tramite un relay presente in orbs.dorkslayers.com /usr/share/spamassassin/30_text_sk.cf:lang sk describe RCVD_IN_ORBS Prijaté prostredníctvom serveru v orbs.dorkslayers.com $ Then look for it in /etc/mail/spamassassin. Perhaps someone mistakenly copied old files there... $ grep RCVD_IN_ORBS /etc/mail/spamassassin/* $ After double check, I'm running SA 2.64 but with some pieces of older version ... How could it be ... Usually people copying files around into incorrect places. Sometimes it's an upgrade failure, but usually it's someone tweaking files they shouldn't.
Re: Messages received via OR
On Mon, 2004-11-29 at 20:39, Matt Kettler wrote: > ># spamassassin -V > >SpamAssassin version 2.64 > > If your system actually has a "RCVD_IN_ORBS" rule, then you likely have > some form of config-file corruption and are using rules from an old version > of SA. How could I diagnosys such a thing ? I also remember that when I posted here my mail log file, someone told me I'm running an out of date version of SA. I did not believe him, but you speech make me reconsider the version i'm running. I did not install SA from sources nor from scratch, I only used Debian packages. May be the fault is there ? > note: double-check spelling because RCVD_IN_SORBS is not RCVD_IN_ORBS. It was a copy/paste (first check) I checked again, the copy/pas is right. (second check) After double check, I'm running SA 2.64 but with some pieces of older version ... How could it be ... -- ASPO Infogérance http://aspo.rktmb.org/activites/infogerance Unofficial FAQ fcolc http://faq.fcolc.eu.org/ LUG sur Orléans et alentours. Tél : 02 38 76 43 65 (France)
Re: Messages received via OR
At 02:22 PM 11/29/2004, Rakotomandimby (R12y) Mihamina wrote: > By the way, how ancient a version of SA are you using? ORBS hasn't been > used by SA since 2.55. (although alternate-language describes existed > through 2.64, no actual rule exists in the 2.6x or 3.x families) # spamassassin -V SpamAssassin version 2.64 If your system actually has a "RCVD_IN_ORBS" rule, then you likely have some form of config-file corruption and are using rules from an old version of SA. note: double-check spelling because RCVD_IN_SORBS is not RCVD_IN_ORBS. SORBS is a different list entirely, and you DEFINITELY do not want to increase the score of the base rule for it (RCVD_IN_SORBS). ALL dialup mail matches the base rule for SORBS, even if properly relayed. Only increase the score of the sub-rules for SORBS, such as RCVD_IN_SORBS_ZOMBIE, etc.
Re: Messages received via OR
On Mon, 2004-11-29 at 19:19, Matt Kettler wrote: > By the way, how ancient a version of SA are you using? ORBS hasn't been > used by SA since 2.55. (although alternate-language describes existed > through 2.64, no actual rule exists in the 2.6x or 3.x families) # spamassassin -V SpamAssassin version 2.64 On Debian testing. -- ASPO Infogérance http://aspo.rktmb.org/activites/infogerance Unofficial FAQ fcolc http://faq.fcolc.eu.org/ LUG sur Orléans et alentours. Tél : 02 38 76 43 65 (France)
Re: Messages received via OR
At 01:19 PM 11/29/2004, Matt Kettler wrote: By the way, how ancient a version of SA are you using? ORBS hasn't been used by SA since 2.55. (although alternate-language describes existed through 2.64, no actual rule exists in the 2.6x or 3.x families) Side note on the subject.. ORBS is in fact dead. http://www.dorkslayers.com/ "Due to circumstances beyond our control, the Dorkslayers DNSBLs are no longer available. "
Re: Messages received via OR
At 11:08 AM 11/29/2004, Rakotomandimby (R12y) Mihamina wrote: HEllo, I would like to know how to increase the "rate" or the "mark" of a message received from an open relay. In fact, we're 99,9% sure that it's a spam! are'nt we? I would like to set the "rate" of the RCVD_IN_ORBS to 4 (at least). How to ? in local.cf change the score with a new score statement: score RCVD_IN_ORBS 4.0 Is it a good idea ? Not really. ORBS at last check had a pretty noticeable FP rate. (3% of hits were nonspam, 97% spam in the 2.55 set3 mass-check data). Based on ORBS's FP rate, you clearly can't say we are 99.9% sure. In fact, we're only 97% sure, which is a factor of 30 different. By the way, how ancient a version of SA are you using? ORBS hasn't been used by SA since 2.55. (although alternate-language describes existed through 2.64, no actual rule exists in the 2.6x or 3.x families)
Messages received via OR
HEllo, I would like to know how to increase the "rate" or the "mark" of a message received from an open relay. In fact, we're 99,9% sure that it's a spam! are'nt we? I would like to set the "rate" of the RCVD_IN_ORBS to 4 (at least). How to ? Is it a good idea ? -- ASPO Infogérance http://aspo.rktmb.org/activites/infogerance Unofficial FAQ fcolc http://faq.fcolc.eu.org/ LUG sur Orléans et alentours. Tél : 02 38 76 43 65 (France)
